CVE-2026-56423: MISP Core Broken Access Control in Bulk Deletion (HIGH CVSS 8.8)

Technical summary

Two separate broken access-control vulnerabilities exist in MISP Core's bulk deletion handlers. EventReportsController::deleteSelection authorized deletions using only the global perm_add capability, bypassing per-report ownership checks that exist in single-delete flows. Similarly, SharingGroupsController::deleteSelection relied solely on the global perm_sharing_group capability without validating object ownership via the SharingGroup::checkIfOwner method. An attacker with appropriate role permissions could submit arbitrary report IDs, UUIDs, or sharing group IDs for deletion, including those owned by other organizations. The vulnerability stems from inconsistent authorization logic between single-object and bulk-deletion code paths.

Business impact

Organizations using MISP for threat intelligence coordination face risk of malicious data loss and operational disruption. Attackers with contributor-level or sharing-group permissions could permanently delete critical event reports or sharing-group configurations managed by other teams or partner organizations. This undermines trust in MISP as a collaborative platform, potentially forcing recovery from backups, interrupting intelligence workflows, and degrading the integrity of shared threat intelligence. The instance-wide scope of the attack means the impact is not confined to a single user or organization.

Affected systems

MISP Core deployments are affected. The vulnerability applies to any instance where authenticated users with contributor roles or sharing-group permissions are present. Vulnerability is triggered via the bulk deletion endpoints for Event Reports and Sharing Groups. Single-object deletion operations are not affected, as they employ correct per-object authorization checks.

Exploitability

The vulnerability requires authentication and an attacker must hold either contributor-level or sharing-group-capable role permissions. However, in many collaborative MISP deployments, such roles are commonly granted to legitimate partners and team members. The attack surface is the bulk deletion API endpoints, which accept lists of object identifiers. An attacker need only enumerate or guess valid report IDs or sharing group IDs from other organizations—a feasible task in multi-tenant environments. No user interaction is required beyond submitting the malicious bulk deletion request. The CVSS 3.1 score of 8.8 (HIGH) reflects the low attack complexity, low privilege bar, and high impact across confidentiality, integrity, and availability.

Remediation

Update MISP Core to a patched version that validates ownership or authorization for each object in bulk deletion flows. Verify against the vendor advisory for specific version numbers. The fix requires EventReportsController::deleteSelection to invoke EventReport::fetchIfAuthorized($user, $itemId, 'delete') for each selected report, and SharingGroupsController::deleteSelection to call SharingGroup::checkIfOwner($user, $itemId) before deletion. Organizations unable to patch immediately should restrict contributor and sharing-group-capable role assignments to trusted users, monitor bulk deletion activity, and review audit logs for suspicious deletions.

Patch guidance

Check the MISP project's official release notes and security advisories for the patched version number and release date. Apply the update to all MISP Core instances in your environment. Verify that the patched version includes per-object authorization validation in both EventReportsController::deleteSelection and SharingGroupsController::deleteSelection. Test the update in a non-production environment first to confirm bulk deletion now respects object ownership before deploying to production. Coordinate with all teams that rely on MISP to minimize disruption during the update window.

Detection guidance

Enable and review MISP audit logs for bulk deletion operations targeting Event Reports or Sharing Groups, particularly those owned by other organizations. Look for patterns of deletion requests from users with contributor or sharing-group permissions deleting objects outside their own organization. Monitor for sudden mass deletions that could indicate malicious activity. Network-level detection is difficult without access to request payloads; focus on application-level auditing and behavioral analysis. Establish baseline deletion patterns for your organization and alert on anomalies.

Why prioritize this

This vulnerability merits urgent priority due to its HIGH CVSS score (8.8), low attack complexity, and the destructive nature of the impact. Data loss is irreversible without backups, and the attack requires only authentication with commonly-granted permissions. In multi-tenant MISP environments where cross-organization collaboration is standard, the risk of insider or lateral abuse is elevated. Patching should be scheduled within your standard critical-vulnerability SLA.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects: Network-accessible attack vector (AV:N), no special conditions required (AC:L), low privilege requirement (PR:L, authenticated user with basic role), no user interaction needed (UI:N), and high impact across all three security properties (C:H, I:H, A:H). The scope is unchanged (S:U) because the vulnerability does not escalate privileges or cross security boundaries—it exploits improper authorization checks within the same system. The score appropriately captures the severity of unrestricted data deletion by authorized users outside their permission scope.

Frequently asked questions